security: harden /proc with access controls and hidepid (H2)

security: harden /proc with access controls and hidepid (H2)

- Protect /proc/dmesg: root-only access (euid == 0)
- Protect /proc/cmdline: root-only access (euid == 0)
- Implement hidepid mechanism with g_proc_hidepid global:
  - 0 = visible to all (default)
  - 1 = invisible to non-root, except own process (current default)
  - 2 = invisible to non-root, including own process
- Redact addresses in /proc/<pid>/maps for non-root users:
  - Show 0 instead of actual heap/brk/mmap addresses
  - Applies even to own process for security
- Update proc_root_readdir to respect hidepid for PID listing
- Update proc_root_finddir to respect hidepid for direct PID access

Validation:
- make -j12: PASS
- make test-host: PASS (111/111)
- make test SMOKE_SMP=4: PASS (127/127)
- make test-battery: PASS (153/153)
- make analyzer: PASS

Addresses H2 from docs/URGENT_SECURITY_STATUS_2026-06-09.md